Securing PS_CFG_HOME on Windows

To secure PS_CFG_HOME on Windows:

  1. Ensure that your PS_CFG_HOME is created in a location that is accessible to the user account that needs to start the domain.

    By default, the PS_CFG_HOME location will not be visible to the user account starting the domain because it is created in the user home of the user account creating the domain. Use one of these options to make the PS_CFG_HOME visible to the user account that needs to start the domain:

    • Override the default location for PS_CFG_HOME, by manually setting the PS_CFG_HOME environment variable to a custom value.

    • Enable the restricted user to view the PS_CFG_HOME in the domain creator’s user home. Set the PS_CFG_HOME as a system-level environment variable so that the restricted user will be able to see it when logged on.

  2. While signed in as the domain administrator, create and configure your new application server or Process Scheduler server domain.

  3. While signed on as the domain administrator, apply the necessary read-write restrictions.

    It is recommended to apply read-only privileges to the entire directory path to the domain.

    1. Using Windows Explorer select the domain directory and open the Properties dialog.

    2. Select the Security tab. If the restricted user is not displayed, click Add to append the user to the list.

    3. Once added, highlight the restricted user ID and ensure that the following actions are checked in the Allow column: Read & Execute, List Folder Contents, Read, and Write.

  4. Apply read-only privileges to the sensitive domain files that should be protected from read-write at runtime.

    This typically includes the Tuxedo binary configuration (PSTUXCFG and PSBDMCFG), ASCII configuration files and templates (*.cfg, *.ubb, *.env, *.ubx, *.lst).

    Using Windows Explorer, select each of these files in the domain directory and open the Properties dialog.

    Note:

    At a minimum, it must be possible for the user starting the domain to write to the .adm and LOGS directory within PS_SERVDIR. Additionally, this user must be permitted to create new files in the domain directory.

  5. Sign in as the restricted user, boot the domain, and verify that it is not possible to delete or modify any of the restricted domain files.

    Note:

    Sign in using the same user account as the one entered in the Oracle ProcMGR service.

    Note:

    If subsequent configuration changes are required it is necessary to configure the domain while signed in as the administrator account that created and configured the domain.